GDPR and WhatsApp Business: What Actually Applies

A WhatsApp conversation feels informal. Legally it is not. The moment a customer's number lands in your inbox you are processing personal data, and every message after that adds to it. The rules are less dramatic than the headlines suggest, but they are specific, and they apply whether you run one shared inbox or fifty agents. Our in-depth guide to data privacy and compliance on WhatsApp sets out the whole picture; this article covers what GDPR actually asks of a business using WhatsApp day to day.

A number plus a chat history is personal data

GDPR applies to information relating to an identifiable person, and a phone number qualifies on its own. Add a name, an order, a delivery address, a photo of a damaged product, a voice note explaining why the delivery has to arrive before Thursday, and you have a detailed profile sitting inside a chat thread. The history is the part businesses forget. It is not a phone call that disappears when you hang up — it is stored data you control, search, export, and often feed into automation. Treat the thread the way you treat a CRM record, because that is what it is.

Controller and processor: who is responsible for what

You decide why you message customers and what happens to their replies, which makes your business the controller. The tools you use — your WhatsApp Business Platform provider, your CRM, your ticketing system — handle that data on your instructions, which makes them processors. The split matters because responsibility does not transfer with the data. If a customer complains about how their information was handled, the question lands on your desk, not your vendor's.

In practice that means knowing which companies touch your chat data, on what terms, and where it is stored. That is a written arrangement rather than a handshake, and it is worth reviewing before you switch tools rather than after.

A lawful basis for every message

Each message you send needs a reason the law recognises. Two cover almost everything a WhatsApp CRM does:

• Marketing and promotional messages run on consent — freely given, specific, and recorded. Someone who bought a sofa has not agreed to hear about your summer sale.
• Service messages tied to an order or a request usually rest on performing the contract, or on a legitimate interest you can explain out loud: a delivery update, an appointment reminder, an answer to a question the customer asked.

The line between the two is not always obvious, and blurring it is the most common mistake we see. A delivery update with a discount code stapled to the bottom is a marketing message in uniform. Keep the two streams separate in your templates and your reporting and the basis for each one stays easy to defend.

“

If you cannot say in one sentence why you are allowed to send a message, you are not allowed to send it.

— be digital ai team

Transparency is most of the work

People have a right to know what you do with their data before you do it: who you are, why you are messaging, roughly how long you keep the conversation, and who else sees it. On WhatsApp that rarely means pasting a privacy policy into a chat. It means one plain line at the point of opt-in with a link to the full notice, and a business profile that names the company behind the number. Whatever wording someone saw is the wording you need to reproduce later, which is why keeping consent records that survive an audit is worth building on day one instead of reconstructing under pressure.

Requests that arrive in the chat

Access, correction, and deletion requests do not arrive on headed paper. They arrive as "delete my data" at 22:40 on a Saturday, in the same thread as a shipping question. Your agents need to recognise one when they see it, and your process has to work the same whether the request comes by chat, email, or phone.

Two things make that manageable: a single place where a contact's data actually lives, and a documented routine for responding within the time your regulator expects. Deletion is only real if it reaches exports, backups, and anything you handed to another tool — which is where a clear position on data retention and deletion does the heavy lifting.

The habits that keep you out of trouble

• Give every agent their own login. Shared accounts make it impossible to say who read what.
• Collect what the conversation needs and nothing more, and tell customers not to send documents or card details over chat.
• Review access the week someone changes role or leaves, not at the annual audit.
• Write down where chat data goes: which tools, which countries, which retention period.
• Log every request you receive and what you did about it.

None of this needs a legal department, and none of it replaces one — confirm the specifics for your business, sector, and markets with your own legal counsel. What good operational habits buy you is the ability to answer questions quickly and honestly, which is most of what a regulator, or a cautious enterprise customer, is really asking for.